CVE-2023-35005: Apache Airflow: Information disclosure on configuration view
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.
This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if [webserver] exposeconfig is set to non-sensitive-only), and not all uncensored values are actually sentitive.
This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflowto a version that resolves this vulnerability.Fixed in 2.6.2rc1 - Upgrade
Upgrade
Apache Airflowto a version that resolves this vulnerability.Fixed in 2.6.2 - Configuration
Ensure Apache Airflow is configured so [webserver] expose_config is set to non-sensitive-only; configuration is not exposed in the UI by default.
Apache Airflow webserver [webserver] expose_config = non-sensitive-only
Event History
Frequently Asked Questions
What is CVE-2023-35005?
CVE-2023-35005 is a vulnerability in Apache Airflow that allows potentially sensitive values to be shown to users in certain situations.
How does this vulnerability affect Apache Airflow?
This vulnerability affects Apache Airflow versions 2.5.0 to 2.6.2.
What is the severity of CVE-2023-35005?
The severity of CVE-2023-35005 is medium (CVSS score of 6.5).
How is this vulnerability mitigated?
This vulnerability is mitigated by the fact that the configuration is not shown in the user interface by default, and not all uncensored values are affected.
How do I fix CVE-2023-35005?
To fix CVE-2023-35005, upgrade to a version of Apache Airflow that is not affected (2.6.3 or later).